CVE-2026-23139

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23139", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.972Z", "datePublished": "2026-02-14T15:22:24.059Z", "dateUpdated": "2026-08-05T12:20:21.709Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:21.709Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: update last_gc only when GC has been performed\n\nCurrently last_gc is being updated everytime a new connection is\ntracked, that means that it is updated even if a GC wasn't performed.\nWith a sufficiently high packet rate, it is possible to always bypass\nthe GC, causing the list to grow infinitely.\n\nUpdate the last_gc value only when a GC has been actually performed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerability is triggered by network packets hitting connlimit rules (xt_connlimit, nft_connlimit) or OVS zone limits. A remote unauthenticated attacker can send a flood of packets to trigger the unbounded list growth.\nAC:L - The attacker fully controls the packet rate needed to bypass GC. The nf_conncount module is only loaded when connlimit is in use, so its deployment inherently implies connlimit rules exist. Exploitation is completely reliable.\nPR:N - No authentication or privileges are needed to send network packets that match connlimit rules. The attack is in the packet processing path, not the rule configuration path.\nUI:N - No user interaction is required. The attacker autonomously sends packets to trigger the vulnerability.\nS:U - The impact (kernel memory exhaustion) stays within the kernel's security boundary. No cross-boundary impact such as VM escape.\nC:N - This is a resource exhaustion bug where stale connections are never garbage collected. No information is disclosed to the attacker.\nI:N - No data modification or memory corruption occurs. The list simply grows unboundedly but the entries themselves are well-formed.\nA:H - The connection list grows infinitely, exhausting kernel slab memory via unbounded GFP_ATOMIC allocations. This leads to OOM conditions, system instability, and potential kernel panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conncount.c"], "versions": [{"version": "f106694733c66a48740c25bc4e212e9b2ea364ce", "lessThan": "2c7c71113ed6d3e2f3aca4c088f22283016ff34f", "status": "affected", "versionType": "git"}, {"version": "be69850b461e7b491d87a22e33ab76fdd04b725e", "lessThan": "c4cde57c8affdcca5bcff53a1047e15d268bdca1", "status": "affected", "versionType": "git"}, {"version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "lessThan": "9f45588993d7f115280fc726119ca86fba32a811", "status": "affected", "versionType": "git"}, {"version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "lessThan": "3cd717359e56f82f06cbf8279b47a7d79880c6f3", "status": "affected", "versionType": "git"}, {"version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "lessThan": "26a82dce2beee39c43c109d9647e16f49cb02a35", "status": "affected", "versionType": "git"}, {"version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "lessThan": "8bdafdf4900040a81422056cabe5e00a37bd101a", "status": "affected", "versionType": "git"}, {"version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "lessThan": "7811ba452402d58628e68faedf38745b3d485e3c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conncount.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.161", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.121", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.66", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.6", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2c7c71113ed6d3e2f3aca4c088f22283016ff34f"}, {"url": "https://git.kernel.org/stable/c/c4cde57c8affdcca5bcff53a1047e15d268bdca1"}, {"url": "https://git.kernel.org/stable/c/9f45588993d7f115280fc726119ca86fba32a811"}, {"url": "https://git.kernel.org/stable/c/3cd717359e56f82f06cbf8279b47a7d79880c6f3"}, {"url": "https://git.kernel.org/stable/c/26a82dce2beee39c43c109d9647e16f49cb02a35"}, {"url": "https://git.kernel.org/stable/c/8bdafdf4900040a81422056cabe5e00a37bd101a"}, {"url": "https://git.kernel.org/stable/c/7811ba452402d58628e68faedf38745b3d485e3c"}], "title": "netfilter: nf_conncount: update last_gc only when GC has been performed", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_conncount.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2c7c71113ed6d3e2f3aca4c088f22283016ff34f", "status": "affected", "version": "f106694733c66a48740c25bc4e212e9b2ea364ce", "versionType": "git"}, {"lessThan": "c4cde57c8affdcca5bcff53a1047e15d268bdca1", "status": "affected", "version": "be69850b461e7b491d87a22e33ab76fdd04b725e", "versionType": "git"}, {"lessThan": "9f45588993d7f115280fc726119ca86fba32a811", "status": "affected", "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "versionType": "git"}, {"lessThan": "3cd717359e56f82f06cbf8279b47a7d79880c6f3", "status": "affected", "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "versionType": "git"}, {"lessThan": "26a82dce2beee39c43c109d9647e16f49cb02a35", "status": "affected", "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "versionType": "git"}, {"lessThan": "8bdafdf4900040a81422056cabe5e00a37bd101a", "status": "affected", "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "versionType": "git"}, {"lessThan": "7811ba452402d58628e68faedf38745b3d485e3c", "status": "affected", "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_conncount.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.161", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.121", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.66", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5681D252-2924-4757-931E-0C14EC054EF4", "versionEndExcluding": "6.1.161", "versionStartIncluding": "5.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB7A164B-7422-4A1C-82FB-5FCAEE53C06C", "versionEndExcluding": "6.6.121", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F72B884C-B44F-40E4-9895-CE421AC663D0", "versionEndExcluding": "6.12.66", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "879529BC-5B4C-4EBE-BF1D-1A31404A8B2E", "versionEndExcluding": "6.18.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: update last_gc only when GC has been performed\n\nCurrently last_gc is being updated everytime a new connection is\ntracked, that means that it is updated even if a GC wasn't performed.\nWith a sufficiently high packet rate, it is possible to always bypass\nthe GC, causing the list to grow infinitely.\n\nUpdate the last_gc value only when a GC has been actually performed."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nf_conncount: actualizar last_gc solo cuando se ha realizado la GC\n\nActualmente, last_gc se actualiza cada vez que se rastrea una nueva conexi\u00f3n, lo que significa que se actualiza incluso si no se realiz\u00f3 una GC. Con una tasa de paquetes suficientemente alta, es posible eludir siempre la GC, haciendo que la lista crezca infinitamente.\n\nActualizar el valor de last_gc solo cuando se ha realizado realmente una GC."}], "id": "CVE-2026-23139", "lastModified": "2026-06-17T10:20:58.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-14T16:15:53.950", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/26a82dce2beee39c43c109d9647e16f49cb02a35"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2c7c71113ed6d3e2f3aca4c088f22283016ff34f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3cd717359e56f82f06cbf8279b47a7d79880c6f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7811ba452402d58628e68faedf38745b3d485e3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8bdafdf4900040a81422056cabe5e00a37bd101a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9f45588993d7f115280fc726119ca86fba32a811"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c4cde57c8affdcca5bcff53a1047e15d268bdca1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfilter: nf_conncount: update last_gc only when GC has been performed", "id": "2439874", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439874"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nf_conncount: update last_gc only when GC has been performed\nCurrently last_gc is being updated everytime a new connection is\ntracked, that means that it is updated even if a GC wasn't performed.\nWith a sufficiently high packet rate, it is possible to always bypass\nthe GC, causing the list to grow infinitely.\nUpdate the last_gc value only when a GC has been actually performed."], "name": "CVE-2026-23139", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23139\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23139\nhttps://lore.kernel.org/linux-cve-announce/2026021429-CVE-2026-23139-a7b4@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f106694733c66a48740c25bc4e212e9b2ea364ce,2c7c71113ed6d3e2f3aca4c088f22283016ff34f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[be69850b461e7b491d87a22e33ab76fdd04b725e,c4cde57c8affdcca5bcff53a1047e15d268bdca1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d265929930e2ffafc744c0ae05fb70acd53be1ee,9f45588993d7f115280fc726119ca86fba32a811)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d265929930e2ffafc744c0ae05fb70acd53be1ee,3cd717359e56f82f06cbf8279b47a7d79880c6f3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d265929930e2ffafc744c0ae05fb70acd53be1ee,26a82dce2beee39c43c109d9647e16f49cb02a35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d265929930e2ffafc744c0ae05fb70acd53be1ee,8bdafdf4900040a81422056cabe5e00a37bd101a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d265929930e2ffafc744c0ae05fb70acd53be1ee,7811ba452402d58628e68faedf38745b3d485e3c)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.161,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.121,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.66,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.6,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-15T20:34:55.495202+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a release that contains the nf_conncount last_gc fix, such as the latest official distribution update that includes the patch applied in kernel v6.19 final and later releases.", "If a kernel update is not immediately available, disable the nf_conncount module or reduce its activity by applying rate limiting on nf_conntrack connections using netfilter or iptables rules to limit the number of connections per source address.", "Monitor system memory usage and the nf_conntrack table size for abnormal growth, and consider temporarily swapping to a kernel configuration with a smaller connection tracking table until the fix can be deployed."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw is present in the nf_conncount implementation of the Linux kernel, which is part of the netfilter subsystem. It was identified in kernel version 6.19 release candidates 1 through 4, and the vulnerability description indicates the issue exists in all builds that include the same nf_conncount code without the recent fix. Consequently, systems running these kernel versions\u2014or any kernel builds that have not yet incorporated the fix\u2014are susceptible.", "description_and_impact": "The Linux kernel module nf_conncount incorrectly updates the last_gc counter on each new tracked connection instead of only after a garbage collection cycle. This oversight allows an attacker to sustain a high packet or connection rate that keeps the GC from running. By continually bypassing the GC, the connection table expands unbounded, eventually exhausting kernel memory and degrading system performance, potentially causing a denial of service.", "risk_and_exploitability": "The CVSS score of 7.5 reflects a high severity due to the potential for direct resource depletion via network traffic. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in CISA\u2019s KEV catalog. Nevertheless, the attack would require an adversary able to send a sustained high\u2011rate stream of packets that establish new connections, which could be achieved by an external attacker with network access to the target. Successful exploitation would result in memory exhaustion and system slowdown or crash, with the attacker not gaining elevated privileges."}}}}, "created": "2026-02-16T12:01:27.565350+00:00", "updated": "2026-04-15T20:45:06.378312+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-400"]}